From c2f404f993f13d303f9e47d2f97aff727becac7d Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Tue, 11 Sep 2018 07:58:38 +0000
Subject: Make RunLengthDecode()'s buffer out parameter a unique_ptr.

Change-Id: I1dc99831a564e88035c317455411f1eba9aa41c4
Reviewed-on: https://pdfium-review.googlesource.com/41852
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
---
 core/fpdfapi/page/cpdf_streamparser.cpp    | 23 ++++++++++++-----------
 core/fpdfapi/parser/fpdf_parser_decode.cpp | 15 +++++++++------
 core/fpdfapi/parser/fpdf_parser_decode.h   |  2 +-
 3 files changed, 22 insertions(+), 18 deletions(-)

(limited to 'core/fpdfapi')

diff --git a/core/fpdfapi/page/cpdf_streamparser.cpp b/core/fpdfapi/page/cpdf_streamparser.cpp
index fe67634196..69205cb934 100644
--- a/core/fpdfapi/page/cpdf_streamparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamparser.cpp
@@ -70,16 +70,6 @@ uint32_t DecodeInlineStream(pdfium::span<const uint8_t> src_span,
                             uint32_t* dest_size) {
   *dest_buf = nullptr;
   *dest_size = 0;
-  if (decoder == "CCITTFaxDecode" || decoder == "CCF") {
-    std::unique_ptr<CCodec_ScanlineDecoder> pDecoder =
-        CreateFaxDecoder(src_span, width, height, pParam);
-    return DecodeAllScanlines(std::move(pDecoder), dest_buf, dest_size);
-  }
-  std::unique_ptr<uint8_t, FxFreeDeleter> ignored_result;
-  if (decoder == "ASCII85Decode" || decoder == "A85")
-    return A85Decode(src_span, &ignored_result, dest_size);
-  if (decoder == "ASCIIHexDecode" || decoder == "AHx")
-    return HexDecode(src_span, &ignored_result, dest_size);
   if (decoder == "FlateDecode" || decoder == "Fl") {
     return FlateOrLZWDecode(false, src_span, pParam, *dest_size, dest_buf,
                             dest_size);
@@ -93,8 +83,19 @@ uint32_t DecodeInlineStream(pdfium::span<const uint8_t> src_span,
             !pParam || pParam->GetIntegerFor("ColorTransform", 1));
     return DecodeAllScanlines(std::move(pDecoder), dest_buf, dest_size);
   }
+  if (decoder == "CCITTFaxDecode" || decoder == "CCF") {
+    std::unique_ptr<CCodec_ScanlineDecoder> pDecoder =
+        CreateFaxDecoder(src_span, width, height, pParam);
+    return DecodeAllScanlines(std::move(pDecoder), dest_buf, dest_size);
+  }
+
+  std::unique_ptr<uint8_t, FxFreeDeleter> ignored_result;
+  if (decoder == "ASCII85Decode" || decoder == "A85")
+    return A85Decode(src_span, &ignored_result, dest_size);
+  if (decoder == "ASCIIHexDecode" || decoder == "AHx")
+    return HexDecode(src_span, &ignored_result, dest_size);
   if (decoder == "RunLengthDecode" || decoder == "RL")
-    return RunLengthDecode(src_span, dest_buf, dest_size);
+    return RunLengthDecode(src_span, &ignored_result, dest_size);
 
   return FX_INVALID_OFFSET;
 }
diff --git a/core/fpdfapi/parser/fpdf_parser_decode.cpp b/core/fpdfapi/parser/fpdf_parser_decode.cpp
index efa60d8e3b..9041666c07 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode.cpp
+++ b/core/fpdfapi/parser/fpdf_parser_decode.cpp
@@ -210,7 +210,7 @@ uint32_t HexDecode(pdfium::span<const uint8_t> src_span,
 }
 
 uint32_t RunLengthDecode(pdfium::span<const uint8_t> src_span,
-                         uint8_t** dest_buf,
+                         std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
                          uint32_t* dest_size) {
   size_t i = 0;
   *dest_size = 0;
@@ -234,7 +234,8 @@ uint32_t RunLengthDecode(pdfium::span<const uint8_t> src_span,
   if (*dest_size >= kMaxStreamSize)
     return FX_INVALID_OFFSET;
 
-  *dest_buf = FX_Alloc(uint8_t, *dest_size);
+  dest_buf->reset(FX_Alloc(uint8_t, *dest_size));
+  pdfium::span<uint8_t> dest_span(dest_buf->get(), *dest_size);
   i = 0;
   int dest_count = 0;
   while (i < src_span.size()) {
@@ -247,17 +248,17 @@ uint32_t RunLengthDecode(pdfium::span<const uint8_t> src_span,
       if (buf_left < copy_len) {
         uint32_t delta = copy_len - buf_left;
         copy_len = buf_left;
-        memset(*dest_buf + dest_count + copy_len, '\0', delta);
+        memset(&dest_span[dest_count + copy_len], '\0', delta);
       }
       auto copy_span = src_span.subspan(i + 1, copy_len);
-      memcpy(*dest_buf + dest_count, copy_span.data(), copy_span.size());
+      memcpy(&dest_span[dest_count], copy_span.data(), copy_span.size());
       dest_count += src_span[i] + 1;
       i += src_span[i] + 2;
     } else {
       int fill = 0;
       if (i < src_span.size() - 1)
         fill = src_span[i + 1];
-      memset(*dest_buf + dest_count, fill, 257 - src_span[i]);
+      memset(&dest_span[dest_count], fill, 257 - src_span[i]);
       dest_count += 257 - src_span[i];
       i += 2;
     }
@@ -409,7 +410,9 @@ bool PDF_DataDecode(pdfium::span<const uint8_t> src_span,
         *pImageParams = pParam;
         return true;
       }
-      offset = RunLengthDecode(last_span, &new_buf, &new_size);
+      std::unique_ptr<uint8_t, FxFreeDeleter> result;
+      offset = RunLengthDecode(last_span, &result, &new_size);
+      new_buf = result.release();
     } else {
       // If we get here, assume it's an image decoder.
       if (decoder == "DCT")
diff --git a/core/fpdfapi/parser/fpdf_parser_decode.h b/core/fpdfapi/parser/fpdf_parser_decode.h
index eb7beaccdf..0032b97423 100644
--- a/core/fpdfapi/parser/fpdf_parser_decode.h
+++ b/core/fpdfapi/parser/fpdf_parser_decode.h
@@ -48,7 +48,7 @@ uint32_t FlateDecode(pdfium::span<const uint8_t> src_span,
                      uint32_t* dest_size);
 
 uint32_t RunLengthDecode(pdfium::span<const uint8_t> src_span,
-                         uint8_t** dest_buf,
+                         std::unique_ptr<uint8_t, FxFreeDeleter>* dest_buf,
                          uint32_t* dest_size);
 
 uint32_t A85Decode(pdfium::span<const uint8_t> src_span,
-- 
cgit v1.2.3